Conti

Jack Rhysider (0:31)

JACK: There’s a kind of silence that follows a ransomware attack.

Your throat gets dry, your chest gets a little heavy, and everything around you goes silent, especially when you see texts like this flash across your screen; ‘All of your files are currently encrypted. If you try to ignore us…’ CONTI: We’ve downloaded your data and are ready to publish it.

JACK: You don't know who’s on the other side of that ransomware note or just how much damage they may cause if you don't pay up. The most fearsome enemy is the one you can't see. That silence, pulsating fear, can be deafening as it creeps across hospitals trying to treat patients or business owners trying to make payroll or teachers running a class full of kids. CONTI: The time is almost over. We need your decision. If we don't receive any reply to this message, we begin publishing your data.

Conti is here to prevent any further damages.

JACK: For years there was a group that called themselves Conti, and they wreaked havoc across the internet. CONTI: Conti is here to prevent any further damages. JACK: Hackers operate behind a curtain, known mostly by the destruction they leave behind. We rarely hear or see them. They want to remain covered up in the shadows under the guise of codes and keystrokes. But what happens when that curtain gets yanked and suddenly their deepest, darkest secrets are exposed for the whole world to see? Not just their threats against us, but their arguments, their insecurities, and fears?

Intro: These are true stories from the dark side of the internet.

I’m Jack Rhysider.

This is Darknet Diaries.

JACK: When I think about the lifespan of a Russian cyber gang, there’s an image that comes to mind. It’s that Russian nesting doll. You know those wooden dolls that stack together? They stack inside each other. They start small and then they get bigger and bigger and bigger. Russian hackers kind of operate in the same way. One tiny group starts it. They're at the center. Then they develop more and more layers around them. They get bigger and more influential and can rack up millions of dollars and leave a trail of destruction. These Russian cybercriminals seem to be untouchable by the Western authorities. The FBI and Europol can't go into Russia to arrest them, but they can issue arrest warrants for them in case they trip up or fly somewhere outside of Russia. They might get arrested. But you might think that when the cybercriminal gets arrested, it’s all over, right? Well, not exactly. Like those nesting dolls, when a cyber gang forms an outer shell, it forms into something else, sometimes something even more sinister, and it keeps happening over and over until they're splintering cells, each one learning from the other, each one working together. That’s how I think about Conti, one of the most successful ransomware gangs in history. But before I get into Conti, let’s back up a bit and take a look at where they came from. Before them were other ransomware groups. There was the Dyre gang and there was TrickBot. A central person in both of those was a Russian crime boss who went by the name Bentley.

Bentley was an entrepreneur at heart and found creative ways to launder his cybercrime profits. In order to securely access profits from cybercrime, this Bentley character created side hustles to launder his cybercrime profits. It’s a hard problem that hackers have to figure out all the time. How do you turn ransomware payments, stolen credit card data, or crypto into something you can buy without leaving a paper trail? It’s where the business of illegal hacking meets the real world.

Bentley’s big idea was to use his proceeds from the Dyre ransomware gang to create a film production company.

I guess his idea was that if he can make a film with dirty money and then that film makes actual money, then that money is clean. GEOFF: They’re winding up with so much money that they needed some vehicle through which to wash the money. JACK: That’s Geoff White. He’s a good friend of the show. He’s an investigative journalist out of London, and he’s been reporting on some of the world’s most prolific hackers from the US to North Korea to Russia, and he hosts the new BBC podcast on Conti called The Conti Files. Geoff says Bentley’s film production company was called the 25th Floor Film Company, housed in a skyscraper in Moscow.

Now, this wasn't just an idea of Bentley’s; they were making actual films. GEOFF: Obviously they have to make some films, 'cause if you're gonna have a front company, it’s got to actually do some of the work that the front company is supposed to be doing. So, they thought, well, what films should we make? JACK: They worked on some movies and television shows in Russia and surrounding countries, and they also produced action films with A-list American stars. Like, there was this movie called Exposed starring Keanu Reeves, which was made by them. KEANU: Nobody’s talking, and I don't blame them. He’s dead, he’s dead, she’s dead, but somebody knows something.